in the process of building a deployment mechanism, I need a role to make some changes to some files in the a normal user's directory. I am running into permission issues, understandably.
I can't move or rename the file, that seems to "unlink"(remove) the orginal file.
rm ice.list -> no good
ppriv -eD rm
rm[12820]: missing privilege "file_dac_write" (euid = 1002, syscall = 76) for "/export/home/d_usr/ice.list" needed at zfs_delete_final_check+0x40
rm: ice.list not removed: Permission denied
syscall is 76, which is unlinkat
grep 76 /etc/name_to_sysnum
truss -t unlinkat rm ice.list
york_qa_02-ice $ truss -t unlinkat rm ice.list
unlink("ice.list") Err#13 EACCES [file_dac_write]
rm: ice.list not removed: Permission denied
york_qa_02-ice $
add this privilege to the user
as root: usermod -K defaultpriv=basic,file_dac_write ice
now I am able to remove files that not owned by "ice"
here are more details on what "ice" role's privilege is like
york_qa_02-ice $ ppriv $$
21189: -sh
flags = <none>
E: basic,file_dac_write
I: basic,file_dac_write
P: basic,file_dac_write
L: all
york_qa_02-ice $ ppriv -vl file_dac_write
file_dac_write
Allows a process to write a file or directory whose permission
bits or ACL do not allow the process write permission.
In order to write files owned by uid 0 in the absence of an
effective uid of 0 ALL privileges are required.
No comments:
Post a Comment